As is noticed in previous works [1]}, [2]}, the anomaly often occurs in a local substructure of a graph, indicating that we should zoom our receipt field to a suitable local scale.
Therefore, instead of working on a complete dynamic graph, we first sample substructures as the data elements of our anomaly detection framework. Since we focus on detecting the anomalous edges, we perform an edge-based sampling: each edge in the dynamic graph is viewed as the center of the sampled substructure and is denoted as a target edge. For a given target edge, we denote the source node and destination node as target nodes.
